diff --git a/.gitea/workflows/renovate.yml b/.gitea/workflows/renovate.yml
index 7bd8d7a..2889d7a 100644
--- a/.gitea/workflows/renovate.yml
+++ b/.gitea/workflows/renovate.yml
@@ -8,14 +8,21 @@ on:
 jobs:
   renovate:
     runs-on: ubuntu-latest
-    container: ghcr.io/renovatebot/renovate:latest
+    # Pinned: a floating `latest` let a Renovate major change behaviour
+    # unreviewed. Renovate bumps this pin itself (github-actions manager).
+    container: ghcr.io/renovatebot/renovate:44.171.1
     steps:
       - uses: https://github.com/actions/checkout@v4
 
       - name: Run Renovate
         run: renovate
         env:
-          RENOVATE_CONFIG_FILE: renovate.json
+          # Self-hosted (global) settings live here; renovate.json is the
+          # repo config. Without RENOVATE_REPOSITORIES every run was a silent
+          # no-op ("No repositories found") — 28 green runs, zero PRs.
+          RENOVATE_PLATFORM: gitea
+          RENOVATE_ENDPOINT: http://git:3000/api/v1
+          RENOVATE_REPOSITORIES: homelab/stack
           RENOVATE_TOKEN: ${{ secrets.RENOVATE_TOKEN }}
           RENOVATE_GIT_AUTHOR: "Renovate Bot <renovate@fhirworx.io>"
           LOG_LEVEL: "info"
diff --git a/renovate.json b/renovate.json
index 0fb6591..b1983f2 100644
--- a/renovate.json
+++ b/renovate.json
@@ -1,34 +1,63 @@
 {
   "$schema": "https://docs.renovatebot.com/renovate-schema.json",
   "extends": ["config:recommended"],
-  "platform": "gitea",
-  "endpoint": "http://git:3000/api/v1",
-  "gitAuthor": "Renovate Bot <renovate@fhirworx.io>",
-  "automerge": false,
   "labels": ["dependencies"],
+  "automerge": false,
+  "minimumReleaseAge": "7 days",
+  "osvVulnerabilityAlerts": true,
+  "vulnerabilityAlerts": {
+    "labels": ["dependencies", "security"]
+  },
+  "lockFileMaintenance": {
+    "enabled": true,
+    "schedule": ["before 6am on monday"]
+  },
   "packageRules": [
     {
-      "matchUpdateTypes": ["minor", "patch"],
+      "matchUpdateTypes": ["minor", "patch", "digest", "lockFileMaintenance"],
       "automerge": true
+    },
+    {
+      "description": "A Python minor (3.13 -> 3.15) is a runtime migration, not a patch: never automerge it.",
+      "matchDepNames": ["python"],
+      "automerge": false
+    },
+    {
+      "description": "pymupdf 2.x bundles the Polyform-Noncommercial layout code and onnxruntime — a licence decision (see pyproject.toml), not a routine bump.",
+      "matchPackageNames": ["pymupdf"],
+      "allowedVersions": "<2"
+    },
+    {
+      "description": "Generated-workflow tool pins: gen_config.py must re-emit .gitea/workflows after the bump, so a human merges these.",
+      "matchFileNames": ["dev/scripts/backends/gitea.py"],
+      "automerge": false,
+      "prBodyNotes": ["Run `uv run python dev/scripts/gen_config.py` on this branch and commit the regenerated workflows before merging."]
     }
   ],
-  "pip_requirements": {
-    "fileMatch": ["pyproject.toml"]
-  },
-  "docker-compose": {
-    "fileMatch": ["compose.yml"]
-  },
   "dockerfile": {
-    "fileMatch": ["infra/images/*.Dockerfile"]
+    "managerFilePatterns": ["/(^|/)[^/]+\\.Dockerfile$/"]
+  },
+  "github-actions": {
+    "description": "Only the hand-written Renovate workflow; the rest of .gitea/workflows is generated by gen_config.py.",
+    "managerFilePatterns": ["/^\\.gitea/workflows/renovate\\.yml$/"]
   },
   "customManagers": [
     {
       "customType": "regex",
       "description": "Bump `ARG *_VERSION=` pins annotated with a `# renovate:` comment (marimo, yq, otel-cli, …) that the dockerfile manager can't see.",
-      "fileMatch": ["(^|/)[^/]+\\.Dockerfile$"],
+      "managerFilePatterns": ["/(^|/)[^/]+\\.Dockerfile$/"],
       "matchStrings": [
         "# renovate: datasource=(?<datasource>\\S+) depName=(?<depName>\\S+)(?: extractVersion=(?<extractVersion>\\S+))?\\s+ARG \\w+?_VERSION=(?<currentValue>\\S+)"
       ]
+    },
+    {
+      "customType": "regex",
+      "description": "Bump the trivy/crane pins the CI workflow generator installs.",
+      "managerFilePatterns": ["/^dev/scripts/backends/gitea\\.py$/"],
+      "matchStrings": [
+        "# renovate: datasource=(?<datasource>\\S+) depName=(?<depName>\\S+)\\s+\\w+_VERSION = \"(?<currentValue>[^\"]+)\""
+      ],
+      "extractVersionTemplate": "^v?(?<version>.*)$"
     }
   ]
 }